| | | 1 | | import { inject, injectable } from 'inversify'; |
| | | 2 | | import { EnvironmentVariable } from '../../domain/EnvironmentVariable.js'; |
| | | 3 | | import type { ILogger } from '../../domain/ports/ILogger.js'; |
| | | 4 | | import type { ISecretProvider } from '../../domain/ports/ISecretProvider.js'; |
| | | 5 | | import type { IVariableStore } from '../../domain/ports/IVariableStore.js'; |
| | | 6 | | import { TYPES } from '../../types.js'; |
| | | 7 | | import type { PushEnvToSecretsCommand } from './PushEnvToSecretsCommand.js'; |
| | | 8 | | |
| | | 9 | | @injectable() |
| | 12 | 10 | | export class PushEnvToSecretsCommandHandler { |
| | | 11 | | constructor( |
| | | 12 | | @inject(TYPES.ISecretProvider) |
| | 91 | 13 | | private readonly secretProvider: ISecretProvider, |
| | | 14 | | @inject(TYPES.IVariableStore) |
| | 91 | 15 | | private readonly variableStore: IVariableStore, |
| | 91 | 16 | | @inject(TYPES.ILogger) private readonly logger: ILogger, |
| | | 17 | | ) {} |
| | | 18 | | |
| | | 19 | | /** |
| | | 20 | | * Handles the PushEnvToSecretsCommand which imports environment variables |
| | | 21 | | * from a local file and pushes them to the secret store. |
| | | 22 | | * Uses a map file to determine the secret path for each environment variable. |
| | | 23 | | * |
| | | 24 | | * @param command - The PushEnvToSecretsCommand containing mapPath and envFilePath |
| | | 25 | | */ |
| | | 26 | | async handle(command: PushEnvToSecretsCommand): Promise<void> { |
| | 13 | 27 | | try { |
| | 13 | 28 | | this.logger.info( |
| | | 29 | | `Starting push operation from '${command.envFilePath}' using map '${command.mapPath}'`, |
| | | 30 | | ); |
| | 13 | 31 | | const config = await this.loadConfiguration(command); |
| | 13 | 32 | | const validatedPaths = this.validateAndGroupByPath(config); |
| | 13 | 33 | | await this.pushParametersToStore(validatedPaths); |
| | | 34 | | |
| | 7 | 35 | | this.logger.info( |
| | | 36 | | `Successfully pushed environment variables from '${command.envFilePath}' to secret store.`, |
| | | 37 | | ); |
| | | 38 | | } catch (error) { |
| | 6 | 39 | | const errorMessage = this.getErrorMessage(error); |
| | 6 | 40 | | this.logger.error(`Failed to push environment file: ${errorMessage}`); |
| | 6 | 41 | | throw error; |
| | | 42 | | } |
| | | 43 | | } |
| | | 44 | | |
| | | 45 | | private async loadConfiguration(command: PushEnvToSecretsCommand): Promise<{ |
| | | 46 | | paramMap: Record<string, string>; |
| | | 47 | | envVariables: Record<string, string>; |
| | | 48 | | }> { |
| | 13 | 49 | | this.logger.info(`Loading parameter map from '${command.mapPath}'`); |
| | 13 | 50 | | const paramMap = await this.variableStore.getMapping(command.mapPath); |
| | | 51 | | |
| | 13 | 52 | | this.logger.info( |
| | | 53 | | `Loading environment variables from '${command.envFilePath}'`, |
| | | 54 | | ); |
| | 13 | 55 | | const envVariables = await this.variableStore.getEnvironment( |
| | | 56 | | command.envFilePath, |
| | | 57 | | ); |
| | | 58 | | |
| | 13 | 59 | | this.logger.info( |
| | | 60 | | `Found ${Object.keys(paramMap).length} parameter mappings in map file`, |
| | | 61 | | ); |
| | 13 | 62 | | this.logger.info( |
| | | 63 | | `Found ${Object.keys(envVariables).length} environment variables in env file`, |
| | | 64 | | ); |
| | | 65 | | |
| | 13 | 66 | | return { paramMap, envVariables }; |
| | | 67 | | } |
| | | 68 | | |
| | | 69 | | /** |
| | | 70 | | * Validates and groups environment variables by secret path. |
| | | 71 | | * Ensures that all variables pointing to the same secret path have the same value. |
| | | 72 | | * Returns a map of secret path to value. |
| | | 73 | | */ |
| | | 74 | | private validateAndGroupByPath(config: { |
| | | 75 | | paramMap: Record<string, string>; |
| | | 76 | | envVariables: Record<string, string>; |
| | | 77 | | }): Map<string, { value: string; sourceKeys: string[] }> { |
| | 13 | 78 | | const { paramMap, envVariables } = config; |
| | 13 | 79 | | const pathToValueMap = new Map< |
| | | 80 | | string, |
| | | 81 | | { value: string; sourceKeys: string[] } |
| | | 82 | | >(); |
| | | 83 | | |
| | 13 | 84 | | for (const [envKey, secretPath] of Object.entries(paramMap)) { |
| | 20 | 85 | | const envValue = envVariables[envKey]; |
| | | 86 | | |
| | 20 | 87 | | if (envValue === undefined) { |
| | 1 | 88 | | this.logger.warn( |
| | | 89 | | `Warning: Environment variable ${envKey} not found in environment file`, |
| | | 90 | | ); |
| | 1 | 91 | | continue; |
| | | 92 | | } |
| | | 93 | | |
| | 19 | 94 | | const existing = pathToValueMap.get(secretPath); |
| | 19 | 95 | | if (existing) { |
| | 2 | 96 | | if (existing.value !== envValue) { |
| | 1 | 97 | | const existingMasked = EnvironmentVariable.secret( |
| | | 98 | | existing.sourceKeys[0], |
| | | 99 | | existing.value, |
| | | 100 | | ).maskedValue; |
| | 1 | 101 | | const newMasked = EnvironmentVariable.secret( |
| | | 102 | | envKey, |
| | | 103 | | envValue, |
| | | 104 | | ).maskedValue; |
| | 1 | 105 | | throw new Error( |
| | | 106 | | `Conflicting values for secret path '${EnvironmentVariable.maskSecretPath(secretPath)}': ` + |
| | | 107 | | `'${existing.sourceKeys[0]}' has value '${existingMasked}' ` + |
| | | 108 | | `but '${envKey}' has value '${newMasked}'`, |
| | | 109 | | ); |
| | | 110 | | } |
| | 1 | 111 | | existing.sourceKeys.push(envKey); |
| | | 112 | | } else { |
| | 17 | 113 | | pathToValueMap.set(secretPath, { |
| | | 114 | | value: envValue, |
| | | 115 | | sourceKeys: [envKey], |
| | | 116 | | }); |
| | | 117 | | } |
| | | 118 | | } |
| | | 119 | | |
| | 12 | 120 | | const uniquePaths = pathToValueMap.size; |
| | 12 | 121 | | const totalVariables = Object.keys(paramMap).length; |
| | 12 | 122 | | this.logger.info( |
| | | 123 | | `Validated ${totalVariables} environment variables mapping to ${uniquePaths} unique secrets`, |
| | | 124 | | ); |
| | | 125 | | |
| | 12 | 126 | | return pathToValueMap; |
| | | 127 | | } |
| | | 128 | | |
| | | 129 | | private async pushParametersToStore( |
| | | 130 | | pathToValueMap: Map<string, { value: string; sourceKeys: string[] }>, |
| | | 131 | | ): Promise<void> { |
| | 12 | 132 | | const pathsToProcess = Array.from(pathToValueMap.keys()); |
| | 12 | 133 | | this.logger.info(`Processing ${pathsToProcess.length} unique secrets`); |
| | | 134 | | |
| | | 135 | | // Process secrets in parallel with retry logic for throttling errors |
| | 12 | 136 | | const parameterProcessingPromises = Array.from( |
| | | 137 | | pathToValueMap.entries(), |
| | | 138 | | ).map(([secretPath, { value, sourceKeys }]) => { |
| | 16 | 139 | | return this.retryWithBackoff(() => |
| | 25 | 140 | | this.pushParameter(secretPath, value, sourceKeys), |
| | | 141 | | ); |
| | | 142 | | }); |
| | | 143 | | |
| | 12 | 144 | | await Promise.all(parameterProcessingPromises); |
| | | 145 | | } |
| | | 146 | | |
| | | 147 | | private async pushParameter( |
| | | 148 | | secretPath: string, |
| | | 149 | | value: string, |
| | | 150 | | sourceKeys: string[], |
| | | 151 | | ): Promise<void> { |
| | 25 | 152 | | const envVariable = EnvironmentVariable.secret(sourceKeys[0], value); |
| | 25 | 153 | | await this.secretProvider.setSecret(secretPath, value); |
| | | 154 | | |
| | | 155 | | const keysDescription = |
| | 11 | 156 | | sourceKeys.length > 1 ? sourceKeys.join(', ') : sourceKeys[0]; |
| | | 157 | | |
| | 25 | 158 | | this.logger.info( |
| | | 159 | | `Pushed ${keysDescription}=${envVariable.maskedValue} to secret store at path ${EnvironmentVariable.maskSecretPath |
| | | 160 | | ); |
| | | 161 | | } |
| | | 162 | | |
| | | 163 | | /** |
| | | 164 | | * Retries an async operation with exponential backoff and jitter. |
| | | 165 | | * Handles throttling errors from cloud providers. |
| | | 166 | | */ |
| | | 167 | | private async retryWithBackoff<T>( |
| | | 168 | | operation: () => Promise<T>, |
| | | 169 | | maxRetries = 5, |
| | | 170 | | baseDelayMs = 100, |
| | | 171 | | ): Promise<T> { |
| | | 172 | | let lastError: unknown; |
| | | 173 | | |
| | 16 | 174 | | for (let attempt = 0; attempt <= maxRetries; attempt++) { |
| | 25 | 175 | | try { |
| | 25 | 176 | | return await operation(); |
| | | 177 | | } catch (error) { |
| | 14 | 178 | | lastError = error; |
| | | 179 | | |
| | | 180 | | const isThrottlingError = |
| | 14 | 181 | | typeof error === 'object' && |
| | | 182 | | error !== null && |
| | | 183 | | (('name' in error && |
| | | 184 | | (error.name === 'TooManyUpdates' || |
| | | 185 | | error.name === 'ThrottlingException' || |
| | | 186 | | error.name === 'TooManyRequestsException')) || |
| | | 187 | | ('statusCode' in error && error.statusCode === 429)); |
| | | 188 | | |
| | 14 | 189 | | if (!isThrottlingError || attempt === maxRetries) { |
| | 5 | 190 | | throw error; |
| | | 191 | | } |
| | | 192 | | |
| | 9 | 193 | | const exponentialDelay = baseDelayMs * 2 ** attempt; |
| | 9 | 194 | | const jitter = Math.random() * exponentialDelay * 0.5; // 0-50% jitter |
| | 9 | 195 | | const delayMs = exponentialDelay + jitter; |
| | | 196 | | |
| | 9 | 197 | | await new Promise((resolve) => setTimeout(resolve, delayMs)); |
| | | 198 | | } |
| | | 199 | | } |
| | | 200 | | |
| | 9 | 201 | | throw lastError; |
| | | 202 | | } |
| | | 203 | | |
| | | 204 | | private getErrorMessage(error: unknown): string { |
| | 6 | 205 | | if (error instanceof Error) { |
| | 2 | 206 | | return error.message; |
| | | 207 | | } |
| | | 208 | | |
| | 4 | 209 | | if (typeof error === 'string') { |
| | 1 | 210 | | return error; |
| | | 211 | | } |
| | | 212 | | |
| | 3 | 213 | | if (error === null) { |
| | 0 | 214 | | return 'Unknown error (null)'; |
| | | 215 | | } |
| | | 216 | | |
| | 3 | 217 | | if (error === undefined) { |
| | 1 | 218 | | return 'Unknown error (undefined)'; |
| | | 219 | | } |
| | | 220 | | |
| | 2 | 221 | | if (typeof error === 'object') { |
| | 2 | 222 | | const awsError = error as { |
| | | 223 | | name?: string; |
| | | 224 | | message?: string; |
| | | 225 | | code?: string; |
| | | 226 | | }; |
| | 2 | 227 | | if (awsError.name) { |
| | 1 | 228 | | return awsError.message |
| | | 229 | | ? `${awsError.name}: ${awsError.message}` |
| | | 230 | | : awsError.name; |
| | | 231 | | } |
| | | 232 | | |
| | 1 | 233 | | const safeFields: string[] = []; |
| | 1 | 234 | | if (awsError.code) safeFields.push(`code: ${awsError.code}`); |
| | 1 | 235 | | if (awsError.message) safeFields.push(`message: ${awsError.message}`); |
| | | 236 | | |
| | 1 | 237 | | if (safeFields.length > 0) { |
| | 1 | 238 | | return `Object error (${safeFields.join(', ')})`; |
| | | 239 | | } |
| | | 240 | | |
| | 0 | 241 | | return `Object error: ${Object.keys(error as object).join(', ')}`; |
| | | 242 | | } |
| | | 243 | | |
| | 0 | 244 | | return `Unknown error: ${String(error)}`; |
| | | 245 | | } |
| | | 246 | | } |